CVEs published October 5, 2026

A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455.

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455.

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value.

Any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport.

The MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...".

The SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec.

The webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks private, loopback,…

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.

Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the…

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

The deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that remain active when operators do not override them.

Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True.

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public…

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the URL.

P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank.

Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface.

openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL…

Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authenticated ownership of the…

Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy.

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an…

This could lead to remote code execution with no additional execution privileges needed.

This could lead to remote escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to remote escalation of privilege with no additional execution privileges needed.

An image processing library bundled with Ghost contained a vulnerability in its SVG handling.

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts.

A flaw was found in the HyperShift operator.

Deserialization of Untrusted Data vulnerability in Vektor Inc.

The GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 (secret/private) projects they were never invited to and grants them a full…

An authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment.

IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3.

Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal IP addresses.

GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when the caller…

Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL.

APITokenLogMiddleware logs API keys in plaintext.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication.

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL…

The GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list…

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

It then stored that byte count directly in data->results_length and used it in mcux_gau_adc_read_samples() as the number of uint16_t slots available.

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product.

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400.

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module.

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs

Ash stores :atom-typed attributes as strings and compares them as strings.

Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug and project ID, while the public project invitation join endpoint accepts an invitation based…

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by…

Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content.

The ProjectMemberViewSet.partial_update method allows any project member, including a user with the lowest GUEST role, to modify another project member's role.

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids.

A user whose account has been deactivated by setting is_active=False can still log in with existing credentials.

InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic…

FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an…

Versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient.

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

This could lead to local escalation of privilege with no additional execution privileges needed.

The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and the targets.payloads[] array, but did not validate the…

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive…

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key

The fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release.

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This…

Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default.

The fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a…

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint.

A malicious image can advertise DiffIDs from another image while containing different layer contents.

WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().

This could lead to remote denial of service with no additional execution privileges needed.

Crowd Data Center, Crucible and Fisheye.

This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own.

WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download…

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call.

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog.

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods.

Asymmetric resource consumption (amplification) vulnerability in Apache Struts.

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface.

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue…

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download…

Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the…

ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role,…

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge.

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring…

Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them.

When creating a bookmark card, Ghost could store non-image files fetched from an external website as bookmark icons or thumbnails.

SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization.

Embed cards in the Ghost editor could bypass protections against stored cross-site scripting.

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12.

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.

A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.

A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.

A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d.

A vulnerability was detected in Casdoor up to 3.161.1.

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0.

A vulnerability was determined in itsourcecode Online Admission System Project 1.0.

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0.

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0.

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1.

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A vulnerability was detected in itsourcecode Online Admission System 1.0.

A security vulnerability has been detected in itsourcecode Online Admission System 1.0.

A weakness has been identified in itsourcecode Online Admission System 1.0.

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0.

A vulnerability was found in SourceCodester Drug Recommendation System 1.0.

A vulnerability was detected in itsourcecode Online Admission System 1.0.

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without…

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory.

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control.

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

ApiAdmin v5.0 and before is vulnerable to Directory Traversal.

This could lead to remote code execution with System execution privileges needed.

A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme.

Src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward.

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a…

Deserialization of Untrusted Data vulnerability in Smackcoders Inc.

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices.

The PUT /console/api/apps/&lt;app_id&gt;/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without…

An IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install) allowed authenticated remote attackers to bypass the…

Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. read_resource forwarded the attacker-controlled…

The V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query.

BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping.

Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558.

Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

Adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a…

This could lead to local escalation of privilege with no additional execution privileges needed.

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local…

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks:…

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication.

The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running…

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs.

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is…

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit.

Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security vulnerabilities.

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB)

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed.

SVG images included in content imports were stored without sanitization.

Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace.

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links.

LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer.

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document.

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege.

This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

Create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check…

Versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in the installation of the HTTPS interception root certificate into the Local Computer certificate store.

A Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value.

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

Feehi CMS 2.1.1 is vulnerable to Directory Traversal.

A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the…

ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server.

A flaw was found in Maestro.

This could lead to a remote denial of service with no additional execution privileges needed.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider…

Structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path.

OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP.

The /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the…

The default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the…

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

The get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set.

An input validation issue allowed members to access comments they were not authorized to access.

Staff with the Author role could delete posts and pages that they did not author.

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a…

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows Stored XSS.This issue affects Logo Showcase: from n/a…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects…

The cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace.

GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role.

Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project.

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Stored…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from…

Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a…

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from…

Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates:…

Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from…

A flaw was found in maestro.

Versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component.

apko allows users to build and publish OCI container images built from apk packages.

A security flaw has been discovered in dotnet eShop .NET 8.

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0.

A weakness has been identified in feelec-yishu feelcrm-os 1.0.0.

A vulnerability was determined in TallCMS up to 4.8.0.

A flaw has been found in feelec-yishu feelcrm-os 1.0.0.

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455.

A vulnerability was identified in itsourcecode Online Admission System 1.0.

A vulnerability was detected in vgmstream up to r2117.

A security flaw has been discovered in vgmstream up to r2117.

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A vulnerability has been found in itsourcecode Online Admission System 1.0.

A flaw has been found in itsourcecode Online Admission System 1.0.

A vulnerability was identified in itsourcecode Online Admission System 1.0.

A vulnerability was determined in Jeebase 0.0.1.

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c.

This could lead to local denial of service with no additional execution privileges needed.

Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front…

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values are taken from the dc_filter_<fieldId>…

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules.

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected.

App.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values.

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest.

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers…

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so…

The Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

Assemble-chunks retrieves an upload session using only its session ID, while upload-chunk correctly scopes the lookup to the authenticated profile.

Logout clears the browser's auth-token cookie without revoking the corresponding server-side session.

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation.

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup.

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is executed in the browser.

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution.

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints.

This could lead to local denial of service with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

This could lead to local information disclosure with no additional execution privileges needed.

A flaw was found in Quay.

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.

A flaw was found in sssd.

The LabelFormat field allows for a Cross Site Scripting (XSS) payload.

A flaw was found in the maestro gRPC broker.

Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a…

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using…

Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers.

Authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the…

The delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file.

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields.

Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review links by spoofing Origin or X-Forwarded-Host headers.

A vulnerability has been found in Gerapy up to 0.9.13.

BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace…

The issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace.

WorkspaceOwnerPermission does not require is_active=True when checking whether a user is a workspace owner.

A Project Member with role 15 can send a PATCH request to the project-member update endpoint at /api/workspaces/{workspace_slug}/projects/{project_id}/members/{member_pk}/ to change another user's project role.

GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/{token_id}/ allows the user to modify the token's allowed_rate_limit field without…

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help…

A flaw was found in Quay.

Insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in…

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue…

Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17.

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms…

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated…

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.

A caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling.

The Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings.

The unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link.

The chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object.

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit…

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event…

Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.

Missing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through 1.9.0.0.

The unauthenticated public issues endpoint accepts group_by and sub_group_by query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by F(field),…

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through…

Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects PowerPress Podcasting: from n/a through 11.17.9.

Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a…

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests.

Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc.

Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects…

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials.

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature.

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed.

The delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner.

A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets.

A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive.

A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive.

A weakness has been identified in vgmstream up to r2117.

A vulnerability has been found in django-haystack up to 3.3.0.

A security flaw has been discovered in Shaarli up to 0.16.3.

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1.

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0.

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0.

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0.

Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing.

Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.

Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy…

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

The get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction.

Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role.

A flaw has been found in O2OA up to 10.0.1-ce.

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0.

A security vulnerability has been detected in vgmstream up to r2117.

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1.

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.

GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{slug}/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking…

The modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace.

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a…

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects…

Insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager.

Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help…

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons of the back-end lists call did not check the…

Flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header.

A flaw was found in Quay.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network…

A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network.

An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

A vulnerability has been found in sgl-project sglang up to 0.5.21.

A vulnerability was detected in linlinjava litemall up to 1.8.0.

Versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component.

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0.

A vulnerability was found in code-projects Human Resource Management System 1.0.

A flaw has been found in code-projects Human Resource Management 1.0.

This could lead to local information disclosure with no additional execution privileges needed.

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff…

A flaw was found in SSSD.

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit…

Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted…

Any staff-level user was able to determine the relative ordering of other staff users' hashed passwords.

An SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server.

A weakness has been identified in SourceCodester Drug Recommendation System 1.0.

An argument injection flaw was found in CUPS.

The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem.

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service…

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application.